getOutputStream() has already been called for this response

When I use Logbook auto configuration with Spring Security with Spring Boot app packaged as war and deployed to Tomcat and try to access non existent url, I get

Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback.

Tue Mar 07 18:14:22 CET 2017
There was an unexpected error (type=Internal Server Error, status=500).
getOutputStream() has already been called for this response

I have prepared minimal example to reproduce it here

without Logbook it works as expected - basic auth is required
without Spring Security it works as expected - not found error message is shown
when packaged as jar with embedded Tomcat it works perfectly

The problem is not present only when accessing non existent url - if there would be any controllers in my example, you would not be able to access them neither.

Start with the linked minimal example and reproduce the failure when the Spring Boot app is packaged as a WAR and deployed to Tomcat. Compare the Logbook auto-configuration, Spring Security, and embedded-Tomcat cases described in the issue. Done means nonexistent URLs show the expected error response and protected controllers still require basic authentication without the getOutputStream() error.